TIBCO JasperReports Server Privilege Escalation Via Race Condition
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA.
Summary
The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO JasperReports Server | up to 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server Community Edition | up to 7.1.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server for ActiveMatrix BPM | up to 6.4.3 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft for AWS with Multi-Tenancy | up to 7.1.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft Reporting and Analytics for AWS | up to 7.1.0 | — | No fix listed | CNA |
- TIBCO JasperReports Server VendorTIBCO Affected up to 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Server Community Edition VendorTIBCO Affected up to 7.1.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Server for ActiveMatrix BPM VendorTIBCO Affected up to 6.4.3 Fixed in — No fix listed CNA
- TIBCO Jaspersoft for AWS with Multi-Tenancy VendorTIBCO Affected up to 7.1.0 Fixed in — No fix listed CNA
- TIBCO Jaspersoft Reporting and Analytics for AWS VendorTIBCO Affected up to 7.1.0 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:* | up to 6.3.4 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* | up to 6.4.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* | up to 7.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.4.1:*:*:*:*:*:*:* | 6.4.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:* | 6.4.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.4.3:*:*:*:*:*:*:* | 6.4.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.1.0:*:*:*:*:*:*:* | 7.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:* | up to 7.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:* | up to 7.1.0 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:* Versions up to 6.3.4 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* Versions up to 6.4.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* Versions up to 7.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.4.1:*:*:*:*:*:*:* Versions 6.4.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:* Versions 6.4.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.4.3:*:*:*:*:*:*:* Versions 6.4.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:* Versions up to 7.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:* Versions up to 7.1.0 Vulnerable ·TIBCO
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-18808
- 2026-10-03 Alias added: GHSA-85xr-j783-4jm2
References
More TIBCO Jasperreports Server vulnerabilities
- TI-2018-03944 TIBCO JasperReports Server Information Disclosure Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2018-13320 TIBCO JasperReports Library Directory Traversal Vulnerability KEVCVSS 3.1MEDIUM 6.5
- TI-2020-07525 TIBCO JasperReports Server Fails To Enforce Access Restrictions CVSS 3.1CRITICAL 9.8
- TI-2018-13325 TIBCO JasperReports Server User Information Disclosure CVSS 3.0CRITICAL 10.0
- TI-2020-07526 Cross-site scripting in TIBCO JasperReports Library CVSS 3.1HIGH 8.8
- TI-2017-03548 TIBCO JasperReports Server credentials disclosure CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-18808 · CVE Program
- CVE-2018-18808 · NVD
- FIRST EPSS
- GHSA-85xr-j783-4jm2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences